CVE-2014-8149

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/01/22/1Mailing List, VDB Entry
http://www.securityfocus.com/bid/72280Third Party Advisory, VDB Entry
https://git.opendaylight.org/gerrit/#/c/13972/Patch, Vendor Advisory
https://git.opendaylight.org/gerrit/#/c/14088/Patch, Vendor Advisory
https://wiki.opendaylight.org/view/Security_AdvisoriesVendor Advisory
http://www.openwall.com/lists/oss-security/2015/01/22/1Mailing List, VDB Entry
http://www.securityfocus.com/bid/72280Third Party Advisory, VDB Entry
https://git.opendaylight.org/gerrit/#/c/13972/Patch, Vendor Advisory
https://git.opendaylight.org/gerrit/#/c/14088/Patch, Vendor Advisory
https://wiki.opendaylight.org/view/Security_AdvisoriesVendor Advisory

Timeline

Published: Jun 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-81504.3CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary CVE-2014-81515.8The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTran CVE-2014-81525.0Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism CVE-2014-81534.0The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of se CVE-2014-81547.5The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows cont CVE-2014-81554.3GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spo CVE-2014-81567.8The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.CVE-2014-81577.5Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cra CVE-2014-81586.8Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash CVE-2014-81596.9The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly CVE-2014-81605.0net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain CVE-2014-81614.3PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated u